OWASP BeNeLux Day Exploring the ecosystem of malicious domain registrations in the .eu TLD

### Overview This presentation details joint research conducted between a research lab at KU Leuven and EURid, the registry managing the .eu top-level domain (TLD). The study investigates the ecosystem of malicious domain registrations within .eu, specifically focusing on how malicious actors register domains in bulk to support hit-and-run campaigns (e.g., spam, phishing, command-and-control). Analyzing 824,000 first-time registrations collected over a 14-month period, the researchers set out to identify recurring patterns across registrant data, evaluate campaign behaviors, automate campaign discovery using machine learning, and build proactive detection and prevention mechanisms at registration time.

### Key Topics - **Bulk Registration and Hit-and-Run Dynamics:** Malicious actors rapidly rotate through domain names to evade blacklisting; prior literature cited showed 60% of malicious domains are discarded after just one day. In this study, 75% of malicious domains were blacklisted within 5 days, and 98% within 30 days. - **Dataset and Ground Truth Enrichment:** The dataset comprised 824,000 initial registrations from EURid (transfers and re-registrations were excluded). External ground truth was established by querying three blacklist feeds—Spamhaus, SURBL, and Google Safe Browsing—identifying approximately 2.5% (~21,000 domains) as malicious. Name server locations were enriched using the MaxMind Free database. - **Campaign Identification:** A campaign was defined as a set of malicious registrations sharing common patterns attributable to the same actor over time. Using registrant contact information (names, email addresses, phone numbers, street addresses), registrar usage, and registration spikes, 20 distinct campaigns covering up to 2,000 domains each were manually identified. - **Behavioral Patterns and Facilitators:** Attackers showed distinct temporal behaviors, including concentration during normal business hours/weekdays and noticeable seasonal dips (summer, Christmas, spring breaks). Registration facilitators exhibited high concentration: a single registrar accounted for 50% of all malicious registrations (with over one-third toxicity), and the top three registrant email addresses accounted for roughly 70% of malicious registrations. - **Machine Learning and Proactive Prevention:** The team applied agglomerative clustering to evaluate automated campaign discovery against manual findings, and developed a predictive classifier combining clustering and reputation scoring to block malicious registrations at submission time.

### Technical Details - **Campaign Characteristics:** Identified campaigns varied from short, intense bursts (e.g., 2,000 registrations in 37 days) to long, low-rate campaigns (154 registrations across 300 days). Campaign C11 operated over 8 months with ~1,200 flagged domains, recycling a private email domain with two email accounts, three phone numbers, two street addresses, and four registrars sequentially. - **Blacklist Expansion:** Examining campaign domains that were not flagged by external blacklists (~4,000 domains), manual verification revealed that less than 1% were false positives, showing that campaign-level clustering can expand existing blacklists by roughly 20%. - **Evasion and Obfuscation (Campaign C15):** The most sophisticated campaign utilized an identity generation tool seeded with Dutch data (and English surnames) to generate 98 fake registrant identities registering ~500 domains across 258 days. Domain names combined Dutch vocabulary words with occasional typo binding letters, registered in distinct batches of 8, 16, 24, or 32. This campaign fragmented into numerous small clusters, evading standard top-cluster identification. - **Clustering Evaluation:** Agglomerative clustering produced 432 clusters, with the 30 largest covering 92% of the dataset. Comparing these to the 20 manual campaigns revealed that 26 clusters mapped 1-to-1 to campaigns, while several campaigns shared single clusters, indicating that the 20 manual campaigns actually stemmed from approximately 17 distinct actors. - **Real-Time Detection Results:** Combining agglomerative clustering with reputation scoring of phone numbers, emails, and registrars allowed early detection of 60%–70% of malicious domains at registration time with an extremely low false-positive rate (approximately two to three registrations per day).

### Takeaways Attackers rely heavily on specific registrars, free or private email providers, and synthetic registrant identities composed of reused components. Because external blacklisting has a latency window of several days, post-facto blacklisting alone is insufficient. The research demonstrates that combining manual domain intelligence with agglomerative clustering and reputation classifiers enables registries to block or challenge between 60% and 70% of malicious registrations at registration time, a capability EURid is deploying via its Trust and Security program to raise the cost for malicious actors.